Hungary Recording Laws: Privacy Rules and Penalties (2026)

How Hungary Regulates Recording Conversations

Hungary takes a layered approach to recording law. Three separate legal frameworks protect people from unauthorized recordings, each operating independently with its own enforcement mechanism and penalties.

The Criminal Code (Act C of 2012, known as the Büntető Törvénykönyv or Btk.) makes unauthorized recording a criminal offense. The Civil Code (Act V of 2013, the Polgári Törvénykönyv or Ptk.) treats voice recordings as protected personality rights. And the EU General Data Protection Regulation, implemented through Hungarian law and enforced by the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, or NAIH), governs voice recordings as personal data.

Act LIII of 2018 on the Protection of Privacy adds another dimension, explicitly protecting the right to private life including voice recordings and providing a basis for civil claims when that right is violated.

The practical result: recording someone in Hungary without proper consent can trigger criminal prosecution, civil lawsuits, and administrative fines all at once. The threshold for consent is high. It must be informed, specific, and freely given. Silence or continued participation in a conversation does not qualify.

Criminal Code: Section 422 and Illegal Data Acquisition

Section 422 of the Hungarian Criminal Code, titled tiltott adatszerzés (illegal data acquisition), is the primary criminal provision governing unauthorized recordings. This section covers a broad range of surveillance-related conduct.

What Section 422 Prohibits

Under Section 422(1), it is a criminal offense for anyone to unlawfully acquire personal data, private secrets, business secrets, or trade secrets by:

• Secretly searching another person's home or premises
• Observing or recording activities using technical means in another person's residence
• Opening another person's sealed correspondence and recording its contents
• Intercepting data transmitted via electronic communications networks or information systems

Section 422(2) extends the same penalties to anyone who gathers information to identify undercover law enforcement officers or persons secretly cooperating with authorities.

Section 422(3) makes it equally criminal to disclose or use data obtained through these illegal methods. Passing along a recording you know was made illegally carries the same penalties as making the recording yourself.

Penalties Under Section 422

The basic offense under Section 422(1) carries a penalty of up to 3 years imprisonment.

Section 422(4) increases the penalty to 1 to 5 years imprisonment when the offense involves:

• Impersonating an official or pretending to act under official authority
• Commercial or business-scale operations (üzletszerűen)
• Criminal conspiracy
• Conduct that causes significant harm to the victim

These are felony-level penalties in the Hungarian system. A conviction creates a permanent criminal record and can result in additional consequences including loss of employment and professional licenses.

Section 224: Breach of Correspondence Secrecy

Section 224 of the Criminal Code, levéltitok megsértése, criminalizes the destruction, opening, or interception of sealed communications, including electronic messages. The basic offense is classified as a misdemeanor (vétség). However, penalties escalate sharply based on circumstances.

The standard penalty is short-term detention. When the offender uses their official position or public authority, the penalty rises to up to 1 year imprisonment. When the offense causes significant harm, the maximum becomes 2 years. When an official causes significant harm through abuse of position, the penalty reaches up to 3 years imprisonment.

Section 224 offenses are prosecuted through private complaint (magánindítványra büntethető). The victim must file a complaint within 30 days of discovering the offender's identity. If the offense relates to a crime already under state prosecution, public prosecutors may proceed independently.

Section 223: Breach of Private Secrets

Section 223, magántitok megsértése, targets professionals who disclose confidential information learned through their work. This applies to doctors, lawyers, psychologists, public notaries, and public officials who reveal private information without justified cause.

The basic penalty is detention. When the disclosure causes significant harm, the penalty increases to up to 1 year imprisonment. Like Section 224, this offense requires a private complaint to initiate prosecution.

Section 219: Misuse of Personal Data

Section 219, személyes adattal visszaélés, addresses unauthorized handling of personal data contrary to data protection law. The penalties depend on the type of data involved.

Processing ordinary personal data without authorization or contrary to its stated purpose carries up to 1 year imprisonment. Offenses involving special categories of personal data, including biometric identifiers such as voice patterns, can result in up to 2 years imprisonment. When the offender acts in an official capacity or abuses public authority, the maximum penalty rises to 3 years imprisonment and the offense is classified as a felony (bűntett).

The law requires either a profit-seeking motive or conduct that causes significant harm. Both elements demand intentional conduct.

Civil Code: Personality Rights and Voice Protection

Hungary's Civil Code provides a parallel track of protection that is entirely independent of criminal prosecution. Under the Ptk., voice recordings are classified as personality rights, placing them alongside fundamental protections like the right to life, bodily integrity, reputation, and personal liberty.

Section 2:42 General Personality Rights

Section 2:42 of the Civil Code establishes the general framework for personality rights. Every person has the right to exercise their personality rights freely. The scope of protected rights includes private and family life, good reputation, and, critically for recording law, the right to one's own voice and image.

This provision means that unauthorized recording of someone's voice is not merely a data protection issue. It is an attack on a fundamental right that Hungarian law places in the same category as violations of bodily integrity.

Section 2:48 Protection of Image and Voice

Section 2:48 specifically addresses image and voice recordings. The law requires consent of the person concerned before making any recording. It further requires separate consent before using or distributing that recording.

This creates a two-step consent process. Permission to record does not automatically grant permission to use the recording. A person who consents to being recorded in a meeting, for example, retains the right to refuse consent for that recording to be shared with third parties or used in other contexts.

Consent under Section 2:48 can be given orally, in writing, or through implied conduct. However, implied consent is interpreted narrowly. The circumstances must clearly indicate that the person understood a recording would be made and affirmatively agreed to it.

Section 2:52 Grievance Awards

When personality rights are violated through unauthorized recording, Section 2:52 provides for grievance awards (sérelemdíj). This is a form of non-pecuniary damages with an important characteristic: the claimant does not need to prove actual harm.

The mere establishment of a personality rights violation triggers the right to a grievance award. Courts determine the amount based on the severity of the infringement, whether it was repeated, the degree of fault, and the impact on the claimant and their social environment.

This means that even if an unauthorized recording causes no measurable financial loss, the person recorded can still recover monetary compensation through civil proceedings.

Act LIII of 2018: The Privacy Protection Act

The Privacy Protection Act (a magánélet védelméről szóló törvény) adds a dedicated statutory layer to Hungary's recording protections. Enacted in 2018, this law codifies the right to respect for private life and creates a specific legal basis for civil claims arising from violations.

Section 8(1) of the Act protects the right to respect for private life, explicitly covering voice recordings. Section 11 extends protections to the privacy of communications more broadly.

The Act works alongside the Civil Code rather than replacing it. A person whose voice is recorded without consent can bring claims under both the Privacy Protection Act and the Civil Code's personality rights provisions. The practical significance is that claimants have multiple legal theories available, increasing their chances of obtaining a remedy.

GDPR Enforcement Through the NAIH

As a member of the European Union, Hungary is subject to the General Data Protection Regulation. Voice recordings constitute personal data under the GDPR. Any entity that records conversations must comply with the full range of GDPR obligations.

Legal Basis for Recording

Under Article 6 of the GDPR, every processing of personal data requires a lawful basis. For voice recordings in Hungary, the NAIH has indicated that the primary lawful basis is consent of the data subject under Article 6(1)(a).

Legitimate interest under Article 6(1)(f) can potentially serve as an alternative basis, but the NAIH applies strict scrutiny. Any organization relying on legitimate interest must prepare a documented balancing test before beginning to record. The NAIH has penalized organizations that claimed legitimate interest without conducting this assessment.

For voice analysis that goes beyond simple recording, such as AI-powered emotion detection or keyword analysis, the NAIH has ruled that only freely given, informed consent can serve as the lawful basis. Legitimate interest is not sufficient for advanced voice processing.

Transparency and Notice Requirements

The NAIH requires data controllers to notify individuals at the beginning of a call that the conversation is being recorded. The notice must include:

• The purpose of the recording
• All relevant facts about how the data will be processed
• The identity of the data controller
• Information about the data subject's rights

A vague statement that "this call may be recorded for quality purposes" falls short of NAIH requirements. The notice must be detailed enough for the data subject to make an informed decision about whether to continue the call.

Data Subject Rights for Recordings

Once a voice recording is made, data subjects retain extensive rights. The NAIH has stated that data controllers must enable subjects to listen to the recording and obtain a copy of it based on the right of access under Article 15 of the GDPR.

When a recording involves multiple participants, each person is a data subject with independent rights. A third party seeking access to a multi-person recording must obtain consent from every data subject whose voice appears on the recording.

Data subjects also have the right to erasure ("right to be forgotten") under Article 17 of the GDPR. The NAIH's 2025 enforcement priorities specifically focus on how organizations handle erasure requests, particularly in the banking sector.

NAIH Enforcement Actions and Fines

The NAIH has demonstrated willingness to impose substantial penalties for recording-related violations.

The largest single fine to date, HUF 250 million (approximately EUR 670,000), was imposed on Budapest Bank for using artificial intelligence to analyze customer service call recordings. The bank's AI system assessed callers' emotional states and extracted keywords without proper consent. The NAIH found that the bank's privacy notice failed to adequately disclose the voice analysis program and that the bank improperly relied on legitimate interest rather than obtaining separate consent for the AI processing.

In another case, a house installation company was fined HUF 300,000 (approximately EUR 744) for recording a phone conversation with a customer without prior notice, violating data minimization, purpose limitation, and transparency obligations.

In 2024, the NAIH imposed a total of HUF 335 million in fines across cases involving AI, data breaches, and unlawful surveillance. An employer was fined HUF 15 million for failing to meet transparency obligations regarding workplace surveillance cameras and engaging in disproportionate monitoring.

The maximum administrative fines under GDPR remain available: up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious violations.

Phone Recording Laws in Hungary

Hungary follows an all-party consent standard for phone call recording. Every person on the call must be informed and must consent before recording begins.

Business Phone Recording

Businesses that record customer calls, such as call centers, banks, insurance companies, and telecommunications providers, must comply with multiple requirements simultaneously.

First, the business must have a lawful basis under the GDPR, typically consent. Second, the business must provide clear notice at the start of the call. Third, the notice must contain substantive information about data processing, not just a formulaic announcement.

The NAIH has published specific guidance for call center operations. The guidance requires that businesses provide data subjects with "easy-to-understand information" about voice recordings. Merely stating that a call is being recorded is insufficient. The notice must explain why the recording is being made, how it will be stored, how long it will be retained, and what rights the caller has regarding the recording.

The Reciprocal Recording Right

Hungarian law includes an unusual reciprocal recording principle. Under civil law, if a data controller (such as a business) records a phone conversation, the data subject (the customer) has an equal right to record that same conversation.

This reciprocal right is based on the civil law principle of mutual cooperation (együttműködési kötelezettség). The logic is straightforward: if one party deems it necessary to preserve a record of the conversation, fairness demands that the other party have the same opportunity.

However, the reciprocal right has limits. The data subject may use their recording only for the enforcement or defense of a legal claim in a potential dispute. Publishing, sharing, or distributing the recording beyond legal proceedings would violate the personality rights of the other participants.

In-Person Recording: Consent and Exceptions

Recording face-to-face conversations in Hungary requires the consent of all participants. This applies in homes, offices, restaurants, and any private or semi-private setting.

Private Settings

In private spaces such as homes or private offices, Section 422 of the Criminal Code provides the strictest protections. Secretly recording someone in their residence using technical devices is a criminal offense carrying up to 3 years imprisonment. There is no exception for participants in the conversation. Even if you are a guest in someone's home, recording your conversation with the resident without their consent is illegal.

Public Places and Events

Hungarian law recognizes an important exception for public settings. Crowd recordings and recordings of appearances at public events do not require individual consent from data subjects. This exception is consistent with both the Civil Code and GDPR principles.

This means that filming a public demonstration, a parade, a concert, or a political rally does not require the individual consent of every person captured on the recording. The key distinction is between targeted recording of identifiable individuals (which requires consent) and general documentation of public events (which does not).

However, even at public events, singling out a specific individual for targeted recording would bring the recording back within the consent framework. The public event exception covers the event as a whole, not surveillance of particular attendees.

Workplace Recording and Employee Monitoring

Hungary's Labour Code (Act I of 2012, amended in April 2019) establishes specific rules for workplace surveillance that go beyond general recording law.

Employer Monitoring Rights

Article 11(a) of the Labour Code gives employers the right to monitor whether employees fulfill their job-related duties. Employers may use technical equipment for this purpose, but the monitoring must be:

• Justifiably connected to the employee's work duties
• Proportionate to the legitimate aim pursued
• Conducted with respect for human dignity

The law draws a firm line: surveillance cannot be used to measure employee productivity through video or audio recording. An employer may use cameras to protect property, but not to track how quickly workers complete tasks.

Prohibited Monitoring Locations

Cameras and audio recording devices may never be placed in:

• Showers and changing rooms
• Restrooms and toilets
• Kitchens and dining areas
• Rest facilities and break rooms

The only exception is health and safety monitoring at industrial sites where physical danger exists.

Notice Requirements

Employers must inform employees in advance about any surveillance measures. This includes the type of monitoring being used, the purpose, the data retention period, and the rights of employees regarding the collected data.

The NAIH has fined employers who failed to meet these transparency obligations. In one case, an employer received a HUF 15 million penalty for inadequate disclosure about workplace cameras and for conducting disproportionate monitoring.

Covert Workplace Surveillance

Covert surveillance in the workplace is illegal under Hungarian law. There is no exception for employers who suspect employee misconduct. Even when an employer has reasonable grounds to believe an employee is stealing or engaging in other wrongdoing, secretly recording the employee without notice violates both the Labour Code and the GDPR.

Employees must be informed of monitoring and must be present when their emails are checked. If the employer has not issued a clear, written policy stating that internet access and email are restricted to work purposes only, monitoring of employee communications is not permitted.

CCTV Retention Limits

CCTV recordings in the workplace may generally be stored for only three working days unless a legitimate reason exists for longer retention, such as the recording capturing evidence of a crime or safety incident.

Works Council Involvement

Before implementing surveillance measures that affect a significant number of employees, employers must consult with the works council (üzemi tanács). This consultation requirement is an additional procedural safeguard beyond the individual notification obligation.

Secret Recordings as Evidence in Court

The admissibility of secretly obtained recordings in Hungarian courts follows a nuanced balancing approach rather than an automatic exclusion rule.

The Kúria's Balancing Test

The Hungarian Supreme Court (Kúria) has ruled that "the mere fact that evidence is obtained illegally does not make it impossible to use in front of a court as evidence." Instead, Hungarian courts apply a balancing test that weighs the data protection rights of the recorded person against the interests of procedural fairness and case resolution.

In a landmark child custody case, the Kúria upheld the use of dictaphone recordings made during a psychological examination even though written consent had not been obtained. The court characterized the missing written approval as a "minor procedural fault" rather than grounds for excluding the evidence entirely. The court ordered the recording deleted after use, but permitted the expert opinion based on it to remain in the case file.

Key Factors Courts Consider

• Whether the recording participants were aware of the device
• Whether the recording was made covertly or openly
• The importance of the evidence to the case outcome
• Whether data protection claims are being used to avoid unfavorable evidence
• The balance between privacy rights and fair administration of justice

Civil vs. Criminal Proceedings

In civil cases, Hungarian courts have greater flexibility to admit illegally obtained recordings when the interests of justice require it. In criminal proceedings, stricter rules apply, though even there the Kúria has indicated that case-by-case analysis prevails over blanket exclusion.

Regardless of admissibility in court, the person who made the illegal recording remains subject to criminal prosecution under Section 422 and civil liability under the personality rights provisions of the Civil Code. Using an illegal recording as evidence does not immunize the recorder from legal consequences for making it.

ECHR Oversight: Szabó and Vissy v. Hungary

Hungary's surveillance laws have faced international scrutiny. In the 2016 case Szabó and Vissy v. Hungary (Application No. 37138/14), the European Court of Human Rights found that Hungary's national security surveillance framework violated Article 8 of the European Convention on Human Rights.

The case involved staff members of an NGO who challenged the surveillance powers of Hungary's National Security Services under Act CXXV of 1995. The ECHR found multiple deficiencies.

The surveillance regime was so broad that it could include "virtually anyone" as a target. Authorization was carried out entirely by the executive branch with no judicial oversight. The government intercepted vast amounts of data from individuals who were not even the original subjects of surveillance orders. And there was no effective judicial review of surveillance activities after the fact.

The ECHR ruling requires Hungary to bring its national security surveillance framework into compliance with European human rights standards. The decision stands as a reminder that even government surveillance must operate within legal boundaries, and that Hungarian citizens have recourse to European courts when domestic protections fall short.

Section 226/B: Deepfakes and Manipulated Recordings

Hungary has also addressed the growing problem of manipulated audio and video recordings. Section 226/B of the Criminal Code criminalizes the creation and dissemination of false or manipulated audio or video recordings intended to damage someone's reputation.

The basic offense carries a penalty of up to 2 years imprisonment. When the offense is committed publicly or causes significant harm, the penalty increases to up to 3 years imprisonment.

This provision is increasingly relevant as AI-generated deepfakes become more sophisticated. Creating a fabricated voice recording of someone and distributing it publicly is a criminal offense in Hungary even if the recording was not obtained through illegal surveillance.

Business Compliance Checklist

Organizations operating in Hungary that record conversations must implement comprehensive compliance measures across all three legal frameworks.

Before Recording

• Establish a lawful basis under GDPR Article 6 (typically consent)
• Prepare a balance-of-interests test if relying on legitimate interest
• Create a clear, detailed privacy notice for recorded individuals
• Conduct a Data Protection Impact Assessment if required
• Consult works councils before implementing workplace monitoring

During Recording

• Provide notice at the beginning of every recorded call
• Include substantive information about data processing purposes
• Allow data subjects to opt out if consent is the legal basis
• Ensure the recording system does not capture data from non-consenting parties

After Recording

• Store recordings securely with appropriate access controls
• Limit retention to the minimum period necessary
• Respond to data subject access requests by providing copies of recordings
• Honor erasure requests promptly
• Maintain records of processing activities

What to Avoid

• Never record without clear, prior notice
• Never use voice analysis AI without explicit, separate consent
• Never rely on legitimate interest without a documented balancing test
• Never store workplace CCTV footage beyond three working days without justification
• Never place recording devices in restrooms, changing rooms, or break areas